Controlled substances are highly regulated, and for good reason: unauthorized diversion can fuel abuse, endanger patients, and expose licensed professionals and facilities to serious legal and regulatory consequences. When loss or theft occurs, whether through break-ins, diversion, misplacement, or unexplained disappearance, federal and state laws impose strict reporting requirements that every Drug Enforcement Administration (DEA) registrant must understand and follow.
Recent regulatory clarifications emphasize that missteps, such as delaying written notice or solely relying on submitting online Form 106, can trigger regulatory scrutiny, civil penalties, and reputational harm. These outcomes are avoidable with proper preparation and counsel.
Federal DEA Reporting Requirements
Under 21 C.F.R. 1301.76(b), DEA registrants must report theft or any “significant loss” of controlled substances to their local DEA Diversion Field Division Office in writing no later than one business day after discovery. This initial notice places the DEA on alert, allowing it to promptly address the theft, and preserves the integrity of any ensuing inquiry.
The registrant must then conduct a timely, good-faith investigation and submit a follow-up report, DEA Form 106, within 45 days of discovery, documenting the extent of the loss.
This two-step framework is designed to minimize the window for diversion, facilitate rapid law enforcement response, and ensure that registrants implement appropriate corrective controls. It is not merely a reporting exercise; it is a compliance and risk management mandate. Misjudging what constitutes a “significant loss,” delaying notice, or submitting an incomplete DEA Form 106 are among the most common, and most costly, errors.
What Qualifies as a “Significant Loss”?
The term “significant loss” is not rigidly defined in federal regulations because it varies by the circumstances of the registrant’s business, type and quantity of drugs lost, and diversion risk. Additional factors that help determine if a loss is “significant” include patterns of loss over time and the diversion potential of the missing controlled substances. Because the determination is fact-specific, registrants should document their analysis and rationale when assessing whether a loss rises to the level of “significant” under DEA regulations.
State-Level Reporting: A Parallel Set of Obligations
In addition to federal requirements, many states require prompt notification to boards of pharmacy or other state regulatory bodies when a loss or theft of controlled substance occurs. These rules often specify shorter timelines, mandatory notification forms, or particular documentation standards. Some states also have distinct reporting requirements depending on the dosage form of the controlled substance and whether the loss may be attributable to employee theft.
Failing to satisfy both federal and state reporting requirements can expose registrants to administrative sanctions, fines, or jeopardize their licenses. For example, one California pharmacy owner was placed on probation for failure to maintain accurate inventories of controlled substances and timely report theft to the DEA and the California Board of Pharmacy. Another California pharmacist was ordered to temporarily relinquish her license and pay administrative fines for failure to securely store controlled substances, timely report the loss, maintain an accurate inventory, among other violations.
These examples illustrate that state reporting requirements must be treated as concurrent obligations alongside federal responsibilities. DEA registrants should calibrate their internal policies and procedures accordingly.
Not Just Pharmacies: Practitioners and Clinics Are Also on the Hook
While pharmacies are frequent focal points for diversion controls, practitioners who administer, dispense, or maintain stocks of controlled substances in-office are equally subject to these federal and state reporting requirements. This includes medical practices where controlled substances are stored or administered.
Practitioners must ensure that their office-based inventories, storage areas, and recordkeeping systems meet the same standards of accountability and security, and that staff are trained to identify, escalate, and document suspected losses promptly.
Building a Defensible Reporting and Investigation Protocol
A defensible approach begins with preparation. Healthcare providers should have robust policies and procedures to ensure the secure storage of controlled substances and establish precise timelines for initial DEA notification and state-level reporting. Real-time inventory reconciliation, secure storage consistent with federal and state physical security requirements, and documented chain-of-custody procedures reduce the risk of loss and diversion of controlled substances. Regularly reviewing and updating these policies helps ensure they reflect current regulations and best practices. Additionally, thorough and timely documentation of every step taken during an investigation can help demonstrate compliance if regulatory scrutiny arises.
How Frier Levitt Can Help
Navigating DEA and state reporting requirements is complex, especially when incidents occur unexpectedly. Frier Levitt can guide pharmacies, health systems, and office-based practitioners through the full lifecycle of reporting and strengthen compliance programs.
- We can prepare and evaluate policies and procedures for storing, handling, and tracking controlled substances and advise on best practices to prevent loss and diversion.
- We can assist with preparing the required federal and state notifications to ensure pharmacies and practices meet regulatory requirements and timelines.
If you have experienced a loss, theft, or if you want to review your current protocols against federal and state requirements, Frier Levitt can provide rapid, knowledgeable support. With structured processes, clear timelines, and robust policies and procedures, you can respond decisively, reduce risk, and demonstrate a strong culture of compliance.
Associate
Senior Counsel
